Privacy Policy

1. Who is responsible

The data controller is Ivans Solovjovs, a self-employed person in Latvia, operating Tally. For any privacy question or request, contact ptfcpro@gmail.com.

2. What data we collect

• Account data: your email address and a securely hashed password.
• Financial data you add or import: transactions, uploaded bank-statement files (CSV), account names/IBANs you register, categories, reminders, subscriptions and loans.
• Receipt data: photos/images of receipts you upload and the text extracted from them (merchant, date, items, amounts).
• Technical data: a login session cookie, and minimal server logs needed for security and to keep the service running.

3. Why we process it and our legal basis

We process your data to provide the service you signed up for — storing and organising your finances, categorising transactions, detecting recurring payments, sending reminders and reading receipts. The legal basis is performance of our contract with you (GDPR Art. 6(1)(b)).

Where we rely on your consent (for example, optional analytics if introduced later), the basis is consent (Art. 6(1)(a)), which you can withdraw at any time.

4. AI processing and the parties that process data for us

To read receipt photos, the image is sent to fal.ai, which routes it to a vision model (by default Google Gemini) purely to extract the text on the receipt. Transaction categorisation may optionally use a language model. This data is processed to return a result to you and is not used by us to train models.

We use these processors (sub-processors) only to run the service:

• fal.ai — AI request routing for receipt reading (and any model it forwards to, e.g. Google);
• our hosting and database providers, to store your account and data;
• an email provider, if and when email reminders are enabled.

5. International transfers

Some processors (for example AI providers) may process data outside Latvia/EEA. Where that happens, transfers rely on the safeguards those providers offer (such as EU Standard Contractual Clauses or an adequacy decision).

6. How long we keep your data

We keep your data while your account exists. You can erase your data or delete your account at any time from Settings; once deleted, it is removed from our systems (backups age out on a rolling basis). We do not sell your data.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict or object to processing, to data portability (export), and to withdraw consent. To exercise any of these, email ptfcpro@gmail.com. You also have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija, https://www.dvi.gov.lv).

8. Security

Passwords are stored only as salted hashes, sessions use httpOnly cookies, and access to your data requires authentication. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

9. Children

Tally is not intended for children under 13. In Latvia 13 is the minimum age at which a child can give digital consent under the GDPR.

10. Changes to this policy

We may update this policy. Material changes will be reflected here with a new “last updated” date.

11. Contact

Data controller: Ivans Solovjovs. Email: ptfcpro@gmail.com. Supervisory authority: Datu valsts inspekcija (Latvia).